TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Binance says attackers used a fake job interview to get malware onto an engineer’s work computer, then used compromised credentials and internal systems in an October 29 theft valued at $6.3 billion. The FBI attributed the operation to TraderTraitor, a North Korean hacking group; Binance says it has rebuilt affected systems and is tracing the stolen assets.
Binance says a fake job interview helped attackers compromise an employee’s work computer before an October 29 breach in which cryptocurrency worth $6.3 billion was stolen. In an incident report published November 3, the exchange described a multi-stage operation involving malware, compromised employee devices and credentials, and access to internal tools. The FBI attributed the theft to TraderTraitor, a North Korean hacking operation.
Binance said the operation involved more than a single phishing message or isolated breach. Its report describes an initial compromise in June, when an engineer downloaded a malicious Homebrew installation. The company said its security team detected the malware, replaced the affected device and rotated credentials, but the engineer’s role and colleagues on the wallet infrastructure team had already been exposed to the attacker.
In September, a different software engineer was contacted through a legitimate job-hunting platform by someone posing as a project director. The engineer took part in two interviews with people claiming to represent a company. During the first, a purported human-resources representative shared a social-media account containing personal photos and videos to build trust, Binance said. In the second, a supposed company CEO asked the engineer to download an interview assignment: a code repository containing malware.
Binance said the repository’s code ran during setup on the engineer’s work computer. It replaced part of a legitimate development tool with a malicious version, which could run commands and communicate with an attacker-controlled server. The exchange said the attackers took steps to conceal the script, and its endpoint security tools did not immediately detect it. On October 20, the attackers used the compromised computer and an internal AI tool to reach computers belonging to two wallet-team developers. Binance said a stolen deployment-permission token was then used on October 29 to deploy a container and trigger the theft.
How the Interview Became an Entry Point
The account shows how a hiring process can become a route into systems handling digital assets. Instead of relying on one deceptive link, the attackers reportedly built trust through staged interviews, delivered malware as a coding assignment and used access gained on employee devices to move toward wallet infrastructure.
For cryptocurrency exchanges and other firms, the incident highlights the risks created when a compromised developer device has credentials or permissions that can affect production systems. Binance’s report also raises questions about how internal AI tools and container-deployment access were used in the attack. The company has not said that the AI tool itself was the initial point of compromise; it says the tool was involved later, after an employee computer had been compromised.
The reported $6.3 billion value makes the incident a major security event for Binance and the wider digital-asset sector. The figure is Binance’s valuation of the theft as reported by The Register; further details about the assets, their movement and any recovery were not provided in the source report.
Products Worth Considering
Arlo Pro Wireless Security Camera, 2K HDR, 6th Gen, 4-Camera Kit
Arlo Essential Outdoor Pan-Tilt-Zoom Security Camera, 2K, Wired, 2-Camera Pack
Arlo Ultra 4K HDR Wireless Security Camera (3rd Gen), 3-Camera Kit with SmartHub
As an affiliate, we earn on qualifying purchases.
From June Malware to October Theft
The incident unfolded over several months, according to Binance’s report. The June Homebrew-related compromise preceded the September fake interviews, followed by further access to wallet-team computers on October 20 and the theft on October 29. The sequence suggests the interview was one part of preparation and access-building, rather than the only event in the attack.
The FBI attributed the theft to TraderTraitor, which the source identifies as a North Korean hacking operation linked to Lazarus Group. The report says North Korean operators have used employment-related deception in more than one way: posing as technology workers seeking jobs, and posing as employers to target engineers. Binance said the attackers used the latter approach in this incident.
Binance said it has rebuilt the compromised wallet system and internal AI tool, replaced affected devices, and decommissioned credentials and tokens assigned to compromised engineers. It is working with law enforcement, blockchain intelligence firms and security researchers to trace and freeze assets, and has engaged outside cybersecurity experts to review the incident.
Open Questions on Stolen Assets
The source report does not specify the exact assets stolen, how the $6.3 billion valuation was calculated, or how much—if any—has been recovered or frozen. It also does not give a detailed account of the attackers’ route from the compromised employee computers to the final transaction authorization, beyond describing use of a deployment token, a container and an advanced authorization method.
The FBI’s attribution to TraderTraitor is an official assessment, while Binance’s account of the technical sequence is based on its current investigation. The report does not provide the full evidence behind the attribution or say whether investigators have identified the individuals involved. Binance has not published the independent experts’ findings, and it remains unclear what additional safeguards they will recommend.
Investigation and Security Review
Binance says it is continuing to work with law enforcement, blockchain intelligence firms and security researchers to trace the stolen cryptocurrency and seek to freeze assets. The exchange has also commissioned an independent cybersecurity review, with recommendations for additional protective measures expected after that work is completed.
The company said it is working on a security research fund and initiatives with AI companies and security firms focused on AI security in blockchain environments. No launch date or program details were given. Further updates from Binance, investigators or the independent reviewers may clarify the asset recovery effort, the attack’s transaction-authorization method and the changes planned for employee devices and internal tools.
Key Questions
How did the fake interview contribute to the Binance theft?
Binance says an engineer downloaded a malware-infected code repository presented as an interview assignment. The code ran during setup on the engineer’s work computer and helped attackers gain access that they later used in a wider intrusion.
Who does the FBI say was behind the attack?
The FBI attributed the theft to TraderTraitor, which the source report describes as a North Korean hacking operation linked to Lazarus Group. The report does not provide the evidence supporting that attribution.
When did the theft happen, and how much was stolen?
Binance says the breach occurred on October 29, 2026, and values the theft at $6.3 billion. The source report does not detail the assets included in that valuation.
Has Binance recovered the stolen cryptocurrency?
The source report does not say whether any funds have been recovered. Binance said it is working with law enforcement, blockchain intelligence firms and researchers to trace and freeze the assets.
What has Binance done since the breach?
Binance says it rebuilt the affected wallet system and internal AI tool, replaced compromised devices and decommissioned credentials and tokens assigned to the affected engineers. It has also hired independent cybersecurity experts to review the incident.
Source: theregister.com
